greploop
Pass
Audited by Gen Agent Trust Hub on Aug 10, 2026
Risk Level: SAFECOMMAND_EXECUTION
Full Analysis
- [COMMAND_EXECUTION]: The skill uses
gh,glab, andgitcommands to manage pull requests and merge requests. These are standard development tools and are used here for their intended purpose: fetching PR details, pushing code, and managing review threads. - [EXTERNAL_DOWNLOADS]: The skill interacts with GitHub and GitLab APIs to fetch review metadata. It does not download or execute external scripts or untrusted binaries.
- [DATA_EXFILTRATION]: While the skill reads PR content and comments, it does so within the authenticated context of the user's local repository and the respective platform (GitHub/GitLab). It does not send this data to any unauthorized third-party domains.
- [PROMPT_INJECTION]: The instructions include logic to handle external review comments. While these comments are technically untrusted data, the skill includes a 'Max 5 iterations' safety constraint to prevent runaway loops and instructs the agent to manually review if a comment is actionable before making changes.
Audit Metadata